RDP sessions are encrypted.
By default, Remote Desktop connections are encrypted at the highest level of security available (128-bit). However, some older versions of the Remote Desktop Connection client application do not support this high level of encryption. If a high level of encryption is needed to support legacy clients, the encryption level of the connection can be configured to send and receive data at the highest encryption level supported by the client. There are four levels of encryption available:
The above article lists some additional ways you can add additional security.
When you are connected to the VPN are you able to ping the internal IP of the server?